The WP Rollback plugin for WordPress contains a flaw where sensitive internal data—such as authentication tokens or configuration parameters—can be unintentionally inserted into data that the plugin sends to clients. This behavior allows an attacker or a malicious user to extract that embedded data, thereby compromising the confidentiality of information that should remain internal to the site or to the plugin. The weakness is classified as CWE-201, which captures the exposure of sensitive information through incorrect handling of data in transit.

WordPress sites that have installed any release of the WP Rollback plugin through version 3.1.2 are vulnerable. Versions prior to 3.2.0, including the initial release, are affected. Administrators operating these legacy plugin versions on a WordPress installation are at risk until the plugin is updated to 3.2.0 or later.

The CVSS score of 5.9 places this issue in the medium severity range. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog, indicating limited evidence of widespread exploitation. The likely attack vector is a remote attacker sending crafted requests to the plugin’s endpoints from any network with access to the WordPress site; the flaw can also be triggered by legitimate plugin usage. Because the flaw exposes sensitive data, the potential impact is primarily a confidentiality loss rather than a denial‑of‑service or code‑execution scenario.